Cisco 500-470 Practice Test Questions, Exam Dumps

Practice Exams:

View All

500-470 Cisco Practice Test Questions and Exam Dumps

Question 1

Which two statements best describe the self-healing functionality available on Cisco SD-WAN vEdge routers? (Choose two.)

A. Software reconfiguration capability allowing for dynamic reconfiguration of existing channels
B. During a software upgrade, the system can roll back to the previously running image if connectivity to vManage fails
C. vManage performs routing outage detection to determine reachability issues, assess their scope, and identify root causes
D. When a configuration change causes a loss of connectivity to vManage, the system automatically rolls back to the previous configuration

Correct Answers: B and D

Explanation:

Cisco SD-WAN vEdge routers are designed with self-healing capabilities to ensure network stability and minimize downtime in the event of failures or misconfigurations. Self-healing in this context refers to the router’s ability to detect specific types of failures and then take automated corrective actions without requiring manual intervention. This behavior is vital in large-scale SD-WAN deployments where manual recovery could be time-consuming or inconsistent.

One key self-healing feature is the software rollback during upgrades (Option B). When a new software version is installed on a vEdge, the system monitors the connection to the vManage controller. If, after the upgrade, the vEdge loses connectivity to vManage, the router will automatically revert to the previous software image. This ensures the router can continue to operate normally without being left in a failed or unreachable state due to a problematic upgrade.

Another important self-healing mechanism is the configuration rollback (Option D). If a configuration change results in the vEdge losing connectivity to vManage (for example, due to a misconfigured control policy or tunnel setting), the device can detect this and automatically revert the configuration to its previous working state. This rollback protects against human error and maintains operational connectivity with the SD-WAN fabric.

Option A describes a general software reconfiguration concept, which is useful but not directly tied to self-healing functionality. Option C refers to visibility and monitoring capabilities from vManage but does not represent an autonomous corrective action by the vEdge itself.

Thus, the self-healing functionalities on vEdges focus on automatic rollback mechanisms for both software and configuration, providing resilience and minimizing downtime.

The correct answers are B and D.

Question 2

Which three statements accurately describe the configuration capabilities available in Cisco Identity Services Engine (ISE)? (Choose three.)

A. The ISE Deployment Assistant (IDA) is an integrated application designed to accelerate the deployment process of Cisco ISE
B. Cisco ISE provides a wireless setup wizard and a visibility wizard to guide initial configuration
C. Cisco ISE setup and configuration requires command-line interface (CLI) expertise
D. Cisco ISE offers wizards and built-in templates that simplify the rollout and reduce deployment complexity
E. Cisco Active Advisor is a tool that offers additional guidance specific to Cisco ISE deployments

Correct Answers: A, B, and D

Explanation:

Cisco Identity Services Engine (ISE) is a network security policy management and access control platform designed to enforce secure network access for users and devices. It provides comprehensive identity management and profiling capabilities. To simplify deployment and reduce administrative overhead, Cisco ISE includes several tools and wizards that streamline configuration and accelerate time-to-value for organizations.

Option A is correct because the ISE Deployment Assistant (IDA) is a built-in feature that guides administrators through best practices during initial deployment. It walks users through the configuration of policy sets, network devices, identity sources, and more. This tool is specifically aimed at those who may be new to Cisco ISE or seeking a faster way to bring ISE online.

Option B is also correct. Cisco ISE provides setup wizards, such as the Wireless Setup Wizard and the Visibility Wizard, which automate the configuration steps for common use cases. The Visibility Wizard, for instance, enables administrators to gain insights into network endpoints quickly and effectively, while the Wireless Setup Wizard helps configure policies related to wireless network access.

Option D is correct because Cisco ISE includes pre-canned configurations, templates, and a library of built-in policy sets that make deployment easier and more consistent. These features reduce the complexity of configuring policies manually and help organizations quickly implement secure access controls.

Option C is incorrect because while ISE has a CLI (Command-Line Interface), most configuration is performed through the Graphical User Interface (GUI). It is designed to be user-friendly, and CLI is generally only used for initial setup or troubleshooting.

Option E is incorrect. Cisco Active Advisor is a different Cisco tool used to provide network inventory and lifecycle management, but it is not specific to ISE deployment or configuration.

Therefore, the correct answers are A, B, and D.

Question 3

Which three wireless product families are supported in Cisco DNA Center version 1.1? (Choose three.)

A. AP 1260
B. WLC 8540
C. WLC 5508
D. AP 3800
E. WLC 3504

Correct Answers: B, D, and E

Explanation:

Cisco DNA Center is a network management and automation platform that enables policy-based automation and assurance across the enterprise network. As of version 1.1, DNA Center offers support for specific wireless product families that are compatible with the Cisco Digital Network Architecture (DNA), ensuring they can benefit from automation, telemetry, and analytics features.

Option B (WLC 8540) is correct because the Cisco Wireless LAN Controller 8540 is a high-performance, scalable controller designed for large campus environments. It is fully integrated with DNA Center and is designed to support Cisco DNA features such as Software-Defined Access (SD-Access), network assurance, and automated provisioning.

Option D (AP 3800) is also correct. The Cisco Aironet 3800 Series Access Points are part of the Wave 2 access point family and are fully supported by DNA Center. These APs are capable of high throughput, support for multiple spatial streams, and can be centrally managed and monitored using DNA Center for advanced assurance and automation features.

Option E (WLC 3504) is correct as well. The Cisco 3504 Wireless Controller is a compact yet powerful controller designed for small to medium-sized deployments. It is fully compatible with Cisco DNA Center and supports automation and assurance features needed in a modern wireless network.

Option A (AP 1260) is incorrect. The Cisco Aironet 1260 Series Access Points are legacy products and do not support the full range of features required for DNA Center integration, especially for SD-Access or assurance telemetry.

Option C (WLC 5508) is also incorrect. Although WLC 5508 was widely used in the past, it is considered a legacy product and is not supported in Cisco DNA Center 1.1 due to its hardware limitations and lack of support for modern telemetry and automation capabilities.

In summary, Cisco DNA Center version 1.1 supports modern wireless hardware that can integrate into an SD-Access environment, deliver real-time telemetry, and support policy-based automation. The supported product families include WLC 8540, AP 3800, and WLC 3504, which are designed to work seamlessly with Cisco DNA Center’s architecture.

The correct answers are B, D, and E.

Question 4

Which two resources are commonly used when conducting a Cisco Identity Services Engine (ISE) Proof of Value (POV)? (Choose two.)

A. YouTube
B. CiscoTV
C. dCloud
D. POV Kit
E. Implementation on Production Network

Correct Answers: C, D

Explanation:

A Proof of Value (POV) is a critical phase in evaluating the capabilities of Cisco Identity Services Engine (ISE) before committing to a full deployment. The goal of a POV is to demonstrate the effectiveness, usability, and integration potential of ISE within a customer’s environment. To do this, Cisco provides specific tools and resources designed to simulate real-world conditions while keeping the production environment unaffected.

Option C (dCloud) is correct. Cisco dCloud (Demo Cloud) is a powerful tool that provides access to fully scripted, on-demand lab environments. These environments are pre-configured and maintained by Cisco to help partners and customers showcase technologies like Cisco ISE in action. It allows users to run real-world scenarios without the risk of interrupting a live network. It’s especially useful in POVs for testing features like network access control, posture assessment, and profiling.

Option D (POV Kit) is also correct. The POV Kit refers to a set of resources provided by Cisco or its partners that includes pre-configured virtual machines, test plans, documentation, and sometimes even physical hardware. The kit helps streamline the deployment of ISE in a test environment, enabling fast setup for demonstration and evaluation. It ensures a consistent and effective evaluation experience.

Option A (YouTube) is incorrect. While YouTube may offer Cisco-related videos, it is not an official or structured tool used in ISE POVs. The content on YouTube varies in quality and accuracy, making it unreliable for structured demonstrations or evaluations.

Option B (CiscoTV) is also incorrect. CiscoTV is primarily a platform for broadcasting corporate updates, webinars, and promotional events. It is not a tool used in technical evaluations or proof-of-value exercises.

Option E (Implementation on Production Network) is not advisable during a POV. Deploying Cisco ISE directly into a live production environment during a test or evaluation phase can introduce significant risk. POVs are designed to be isolated and controlled, typically using test networks or simulation environments.

Cisco provides robust tools for conducting ISE Proof of Value demonstrations. The most effective and commonly used resources are Cisco dCloud and the POV Kit, which provide hands-on testing, configuration samples, and structured guidance for showcasing the platform’s capabilities.

The correct answers are C and D.

Question 5

Which three major features of Cisco Identity Services Engine (ISE) most strongly differentiate it from other RADIUS and Network Access Control (NAC) solutions? (Choose three.)

A. BYOD provides auto configuration of endpoints
B. Deep packet inspection upon authorization of endpoints
C. Guest access and guest lifecycle management functionality
D. Software-based firewall capabilities for selected devices and endpoints
E. Ability to authenticate and authorize users and endpoints

Correct Answers: A, C, E

Explanation:

Cisco Identity Services Engine (ISE) is a robust, policy-based access control platform that offers much more than basic RADIUS functionality. It is often compared against other NAC products because of its ability to provide granular control over who and what can connect to the network. ISE stands out in several key areas that make it more capable and feature-rich than many competing solutions.

Option A (BYOD provides auto configuration of endpoints) is correct. One of the key advantages of Cisco ISE is its Bring Your Own Device (BYOD) support, which streamlines the onboarding process for personal devices. Cisco ISE can automatically configure endpoint devices with the appropriate settings, certificates, and policies, which simplifies access while maintaining security. This capability is especially useful in environments where users need to connect multiple types of personal devices to the network securely.

Option C (Guest access and guest lifecycle management functionality) is also correct. Cisco ISE offers a powerful guest access feature that enables secure and temporary network access for visitors. This includes self-registration portals, sponsor approval workflows, and time-limited credentials. The guest lifecycle management functionality ensures that guest accounts are automatically deactivated after a certain period, maintaining compliance and minimizing risk.

Option E (Ability to authenticate and authorize users and endpoints) is correct as well. At its core, ISE provides AAA (Authentication, Authorization, and Accounting) services. It can enforce identity-based policies by validating users and endpoints before granting access. This feature is foundational to any NAC solution and is implemented comprehensively in Cisco ISE.

Option B (Deep packet inspection upon authorization of endpoints) is incorrect. Cisco ISE is not a deep packet inspection tool. While it integrates with technologies that perform traffic inspection (like Cisco Stealthwatch or Firepower), it doesn’t perform DPI as part of endpoint authorization.

Option D (Software-based firewall capabilities for selected devices and endpoints) is also incorrect. Cisco ISE is not a firewall and does not include built-in firewall functionality. Instead, it focuses on policy enforcement and integrates with firewalls for enforcement decisions.

In summary, Cisco ISE excels over many competitors due to its BYOD support, guest lifecycle management, and robust authentication/authorization capabilities, making A, C, and E the correct answers.

Question 6

When integrating Cisco Identity Services Engine (ISE) with Cisco DNA Center (DNA-C), which three services must be enabled under the ISE Administration settings to ensure successful integration? (Choose three.)

A. SXP services
B. ServiceNow
C. Threat-Centric NAC
D. Infoblox
E. PxGrid
F. Passive Identity Service

Correct Answers: C, E, F

Explanation:

Integrating Cisco Identity Services Engine (ISE) with Cisco DNA Center (DNA-C) allows for enhanced policy enforcement, visibility, and automation across the enterprise network. For this integration to function correctly and fully leverage the capabilities of both platforms, specific services within the ISE environment must be enabled.

Option C (Threat-Centric NAC) is correct. Threat-Centric Network Access Control (TC-NAC) is a key feature that provides dynamic policy adjustments based on threat intelligence. When DNA Center integrates with ISE, it can push threat information to ISE, which then uses it to modify endpoint access privileges in near real-time. This feature is critical for security enforcement based on device posture and detected threats.

Option E (PxGrid) is correct. The Platform Exchange Grid (pxGrid) is essential for enabling ISE to share contextual information with DNA Center and other integrated platforms. PxGrid is the main integration service used by DNA-C to subscribe to ISE data—such as user, device, and session information—which is then used for policy definition, segmentation, and compliance enforcement. Without pxGrid enabled, DNA-C cannot receive or correlate identity-based data from ISE.

Option F (Passive Identity Service) is also correct. This service enables ISE to track user logins across the network without needing active authentication at every access point. It provides user and device mapping to DNA Center, allowing DNA-C to maintain a real-time view of endpoint identity and location. This information is crucial for segmentation and trust-based access policies.

Option A (SXP services) is incorrect in this context. SXP (Security Group Tag Exchange Protocol) is used to propagate Security Group Tags (SGTs) in trustsec-enabled networks but is not mandatory for the integration of ISE with DNA-C. It is more relevant in TrustSec-specific deployments.

Option B (ServiceNow) is also incorrect. While ServiceNow can be integrated with ISE for incident response and ticketing, it is not required for DNA Center integration.

Option D (Infoblox) is unrelated. Infoblox integration is typically used for DNS/DHCP/IPAM purposes, and it does not play a direct role in ISE-DNA-C integration.

In summary, the three core services that must be enabled within ISE to allow successful integration with Cisco DNA Center are Threat-Centric NAC, pxGrid, and Passive Identity Service, making the correct answers C, E, and F.

Question 7

Which workflow in Cisco DNA Center is essential for creating and organizing the network hierarchy during setup?

A. Provision
B. Design
C. Policy
D. Assurance

Correct Answer: B

Explanation:

Setting up a network hierarchy is a foundational step in Cisco DNA Center, and it is performed through the Design workflow. This process allows administrators to logically structure their enterprise network, which is critical for successful deployment and policy application in a software-defined network (SDN) environment.

The Design workflow in Cisco DNA Center is where users define the network hierarchy, which includes geographic locations such as areas, buildings, and floors. This hierarchical structure reflects the physical topology of the network and facilitates organized management of network devices and configurations. By accurately modeling the network’s geography, administrators can associate specific configurations, IP address pools, wireless settings, and other site-specific details with each location in the hierarchy.

Within the Design workflow, administrators can also:

Define global settings (e.g., DNS, NTP, SNMP).
Configure device credentials and IP address pools.
Assign wireless SSIDs and network profiles to specific sites.
Configure building floor maps with AP placements for better RF planning.

Let’s consider why the other options are incorrect:

A (Provision): The Provision workflow is used after the network hierarchy has been created. It deals with deploying configurations and images to devices and associating them with specific sites in the hierarchy.
C (Policy): The Policy workflow is used for defining intent-based policies, such as access control or segmentation, and applying them across the network. These policies rely on the existing hierarchy but do not define it.
D (Assurance): The Assurance workflow is for monitoring and analytics. It provides insights into network performance, health, and client experience, but it does not involve the setup or configuration of the hierarchy.

The Design workflow is the essential first step when setting up Cisco DNA Center. It allows the creation of a structured network hierarchy, which serves as the backbone for provisioning, policy application, and assurance functions. Without this structured design, subsequent workflows would lack the necessary context to operate effectively. Thus, the correct answer is B.

Question 8

In the context of Cisco Identity Services Engine (ISE), which three functions are commonly used as part of the automation process during a BYOD (Bring Your Own Device) onboarding flow? (Choose three.)

A. Supplicant Provisioning
B. Device Registration
C. Certificate Enrollment
D. BioMetrics
E. LDAP Multi Tenant Provisioning
F. Active Directory Group Membership

Correct Answers: A, B, C

Explanation:

Cisco Identity Services Engine (ISE) provides a comprehensive and secure BYOD (Bring Your Own Device) solution that allows employees and guests to onboard personal devices onto the enterprise network while maintaining strong security controls and visibility. The BYOD automation flow within ISE is designed to streamline the registration, provisioning, and secure access of user-owned devices. Three critical functions that are central to this automation flow are Supplicant Provisioning, Device Registration, and Certificate Enrollment.

A. Supplicant Provisioning is the process of configuring the device’s network supplicant, which is the software responsible for handling the authentication process. ISE automates the installation and configuration of the supplicant to ensure that the device can communicate securely using 802.1X authentication. This process is essential for seamless network access and proper policy enforcement.

B. Device Registration is the step where the user registers their device with the network. This typically involves associating the device with a specific user identity, which is recorded in ISE. The registration ensures that the device is recognized and can be monitored, managed, or revoked if necessary. This also enables personalized policy application and tracking.

C. Certificate Enrollment is used to issue a digital certificate to the device. This certificate serves as a secure identity for the device and replaces less secure methods like passwords. ISE acts as a certificate authority (CA) or integrates with an external CA to automate this process, making device authentication more robust and scalable.

Now, let’s look at why the other options are incorrect:

D. BioMetrics is not a function of ISE’s BYOD onboarding flow. Biometric authentication (e.g., fingerprint or facial recognition) is handled at the device level and is not orchestrated by ISE.

E. LDAP Multi Tenant Provisioning is not a typical function of the BYOD flow. While ISE can integrate with LDAP directories, multi-tenant provisioning is more relevant in large, segmented environments and is not a standard part of BYOD.

F. Active Directory Group Membership is used in policy decisions and access control, but it is not a direct step in the BYOD automation process. It supports policy enforcement after the device is onboarded.

In summary, the core functions that automate and secure the BYOD onboarding process in ISE are Supplicant Provisioning, Device Registration, and Certificate Enrollment, making the correct answers A, B, and C.

Question 9

Which three use cases best describe the core capabilities of Cisco Identity Services Engine (ISE)? (Choose three.)

A. BYOD
B. Assurance
C. Monitoring
D. Security Incident and Event Management
E. Access Control
F. Segmentation

Correct Answers: A, E, F

Explanation:

Cisco Identity Services Engine (ISE) is a powerful, policy-based security platform that allows organizations to manage and enforce network access policies across wired, wireless, and VPN environments. Its primary role is to control who and what can access the network, based on policies, identity, and context. Cisco ISE supports several major use cases, with BYOD (Bring Your Own Device), Access Control, and Network Segmentation being among the most prominent.

A. BYOD (Bring Your Own Device) is a critical ISE use case. ISE enables secure onboarding of personal devices such as smartphones, tablets, or laptops onto the corporate network. This onboarding process includes registration, device profiling, certificate enrollment, and supplicant provisioning. ISE provides the necessary automation to ensure that non-corporate devices meet compliance and security standards before being granted access.

E. Access Control is perhaps the most fundamental function of Cisco ISE. It uses identity-based policies to control who and what can access the network. Policies are enforced based on roles, device types, security posture, and authentication results. For example, an employee may receive full access, while a guest is limited to internet access only. This is crucial for maintaining a secure network posture in modern environments with diverse user and device profiles.

F. Segmentation refers to dynamically assigning users or devices to different parts of the network (e.g., VLANs or security groups) based on policy decisions made by ISE. This micro-segmentation allows for tighter control and reduces the attack surface by isolating users and devices that do not need to interact. Cisco TrustSec and Security Group Tags (SGTs) are often used in this context to simplify policy enforcement across distributed environments.

Now, looking at the incorrect options:

B. Assurance is a key capability of Cisco DNA Center, not ISE. Assurance involves performance analytics, telemetry, and network health insights, which are not in ISE's functional domain.

C. Monitoring is a supporting capability in ISE for visibility, but it is not considered a standalone use case. ISE provides visibility into endpoints and users but does not offer full-scale monitoring like network performance or application visibility tools.

D. Security Incident and Event Management (SIEM) is another domain entirely. While ISE can forward logs and alerts to SIEM systems, it is not a SIEM platform itself. Its role is more in generating identity-based security events, which SIEM tools can then analyze.

the most accurate Cisco ISE use cases from the given list are BYOD, Access Control, and Segmentation, as they directly align with ISE's core functionalities.

Question 10

Which three statements accurately describe the features available in Cisco SD-WAN license tiers? (Choose three.)

A. With the Pro license, control and data policies are supported
B. The Plus license supports split-tunnel configurations
C. The Pro license includes unlimited segmentation support
D. The Plus license includes support for hub-and-spoke and partial mesh topologies
E. The Enterprise license includes access to vAnalytics
F. The Enterprise license does not support TCP optimization

Correct Answers: A, C, E

Explanation:

Cisco SD-WAN offers a tiered licensing model that enables organizations to choose a level of functionality based on their specific networking requirements. The three main license tiers are DNA Essentials, DNA Advantage (also referred to as Plus), and DNA Premier (also known as Pro). Each tier provides incremental features and capabilities related to security, policy management, application optimization, and analytics.

A. With the Pro license, control and data policies are supported – This is correct. The Pro or DNA Premier license is the most advanced tier, providing comprehensive capabilities for WAN optimization, full policy-based routing, and advanced security controls. Control and data policies, which allow fine-grained control over traffic behavior, routing decisions, and access, are fully supported in this license tier.

C. With the Pro license, unlimited segmentations are supported – This is also correct. Network segmentation is a critical feature for large enterprises managing complex environments. While lower-tier licenses offer limited segmentation capabilities, the Pro license enables unlimited segmentation, making it ideal for multi-tenant or highly secure networks that require isolation between departments, business units, or customer environments.

E. With Enterprise license, vAnalytics is included – This is correct. vAnalytics is a cloud-based analytics and visualization tool that provides insights into application performance, bandwidth usage, and policy effectiveness across the SD-WAN. It is bundled with higher-tier licenses like the DNA Advantage (Plus) and DNA Premier (Pro), making it accessible to organizations with mid-to-high level deployments that require operational intelligence and proactive network management.

Now, let’s examine the incorrect choices:

B. With Plus license, split-tunnel is supported – This is incorrect. Split-tunneling, which allows local breakout of SaaS or internet traffic from the branch rather than routing it through a central hub, is typically a basic SD-WAN function and not unique to the Plus tier. It is available even in the lower tiers.

D. With Plus license, Hub and spoke, partial mesh are supported – This is misleading. Topology options like hub-and-spoke or partial mesh are more foundational and are not exclusively enabled by any particular license tier. These topologies are part of standard SD-WAN fabric capabilities and are typically supported across all license levels.

F. With Enterprise license, TCP optimization is not supported – This is incorrect. TCP optimization is included in the higher-tier licenses like DNA Premier (Pro), not excluded. Optimization features are part of what differentiates the more advanced license tiers from the basic ones.

In summary, control/data policies, unlimited segmentation, and vAnalytics integration are advanced features that correctly align with the Pro and Enterprise level Cisco SD-WAN license tiers.